Privacy Policy

Build & Grow Technology ("we," "us," or "our") operates the website at buildandgrowtech.com and the Oscan application. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

1. Information We Collect

We collect the following types of information:

• Contact information — name and email address when you submit our contact form.
• Salesforce OAuth credentials — when you connect Oscan to your Salesforce org, we receive an OAuth access token and your Salesforce instance URL. We do not store your Salesforce password.
• Salesforce metadata — Oscan reads Apex classes, Flows, Validation Rules, and Visualforce pages from your org solely to generate the risk report. This metadata is processed in memory and is not persisted to any external database.
• Usage logs — server logs may include IP addresses, request paths, and timestamps for debugging and security purposes.

2. How We Use Your Information

• To provide the Oscan scanning service and return risk reports to you.
• To respond to contact form submissions.
• To maintain security and diagnose technical issues.
• We do not sell, rent, or share your personal information or Salesforce metadata with third parties.

3. Salesforce Data & AppExchange Compliance

Oscan is designed to comply with Salesforce's AppExchange security and data handling requirements. Specifically:

• We access your Salesforce org only with your explicit authorization via OAuth 2.0.
• Salesforce metadata retrieved during a scan is used solely to generate your report and is not stored, shared, or used for any other purpose.
• Access tokens are stored in server-side sessions and are not exposed to third parties.
• You may revoke Oscan's access to your Salesforce org at any time from Setup → Connected Apps.

4. Data Retention

Contact form submissions are logged temporarily for response purposes and are not stored in a long-term database. Salesforce metadata is processed in memory during your session and is not retained after the session ends. Session tokens expire automatically.

5. Cookies & Tracking

We do not use advertising cookies or third-party tracking pixels. Session state may be maintained via server-side sessions. We do not use Google Analytics or similar tracking services.

6. Security

We use HTTPS (TLS) for all data transmission. OAuth tokens are stored in encrypted server-side sessions. We follow industry-standard security practices and apply rate limiting and CORS protections to our API endpoints.

7. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children.

8. Your Rights

You may request deletion of any personal information we hold about you by contacting us at the address below. You may also revoke Salesforce access at any time without contacting us.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the most recent revision. Continued use of our services after changes constitutes acceptance of the updated policy.

10. Contact Us